automating-ioc-enrichment
From the author
Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.
Install
npx skills add 26zl/cybersec-toolkit --skill automating-ioc-enrichment -a claude-code
Installs to .claude/skills/automating-ioc-enrichment/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- performing-ioc-enrichment-automation26zl/cybersec-toolkitAutomates Indicator of Compromise (IOC) enrichment by orchestrating lookups across VirusTotal, AbuseIPDB, Shodan, MISP, and other intelligence sources to provide contextual scoring and disposition recommendations. Use when SOC analysts need rapid multi-source enrichment of IPs, domains, URLs, and file hashes during alert triage or incident investigation.Finance★ 82
- ioc-enrichmentgensecaihq/Wazuh-AutopilotEnrich indicators (IPs, domains, URLs, hashes) with reputation and context, grade source reliability with the Admiralty Code, and respect TLP and data-egress rules; use when a case contains external indicators.Engineering★ 60
- security-automationBagelHole/DevOps-Security-Agent-SkillsAutomate security workflows and remediation. Build security pipelines, automate compliance checks, and implement SOAR capabilities. Use when scaling security operations or implementing DevSecOps.Security★ 1.2K
- collecting-indicators-of-compromise26zl/cybersec-toolkitSystematically collects, categorizes, and distributes indicators of compromise (IOCs) during and after security incidents to enable detection, blocking, and threat intelligence sharing. Covers network, host, email, and behavioral indicators using STIX/TAXII formats and threat intelligence platforms. Activates for requests involving IOC collection, indicator extraction, threat indicator sharing, compromise indicators, STIX export, or IOC enrichment.Security★ 82
- api-enrichmentLeadMagic/gtm-skillsBuild API-first enrichment pipelines — provider selection, batching, retries, rate limits, idempotency, webhooks, cost tracking, and CRM writes. Use when integrating enrichment APIs directly into GTM systems or replacing manual data workflows with programmatic pipelines.Engineering★ 68
- hunt-ioctonone-ai/tononeAnalyze indicators of compromise — enrichment, attribution, and response recommendations. Use when asked to "analyze these IOCs", "enrich these indicators", or "what is this hash".Other★ 76
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in